list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive | Jul 1, 2025 | Mar 2, 2025 |
| Alpine Linux | — | Upgrade libarchive | Aug 8, 2025 | Mar 2, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Jul 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Jun 13, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libarchive | Jun 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libarchive | Jul 1, 2025 | Mar 2, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchiveUpgrade libarchive-devel | Jun 30, 2025 | Mar 2, 2025 |
| Redhat_linux | — | Upgrade libarchive-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdunzip-debuginfoUpgrade libarchiveUpgrade bsdtar-debuginfoUpgrade bsdcat-debuginfoNo solution existsUpgrade libarchive-develUpgrade bsdtarUpgrade libarchive-debugsource | Jun 26, 2025 | Mar 2, 2025 |
| Rocky_linux | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchive-debugsourceUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade bsdtar-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade libarchive-develUpgrade libarchive13-32bitUpgrade libarchive13Upgrade bsdtar | Dec 5, 2025 | Jun 26, 2025 |
| Ubuntu | — | Upgrade libarchive13Upgrade libarchive-tools (Ubuntu Pro)Upgrade libarchive-toolsUpgrade bsdtar (Ubuntu Pro)Upgrade libarchive-devUpgrade bsdcpio (Ubuntu Pro)Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive13t64 | Apr 24, 2025 | Mar 2, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub